Privacy Policy Privacy Policy
Last updated: 6 October 2026
Oxyledger (hereinafter “we”) attaches the utmost importance to protecting and respecting your privacy.
Through this statement, we wish to provide you with clear and precise information about the collection and processing of the personal data you may provide to us via the oxyledger.com website (hereinafter the “Site”).
1. Privacy rules.
The General Data Protection Regulation of 27 April 2016 (hereinafter the GDPR) has applied since 25 May 2018. It imposes strict rules and conditions on companies that process the personal data of their customers and prospects, in order to protect their privacy.
2. Data controller.
The “controller” of your personal data is Oxyledger, which is responsible for the oxyledger.com website you are visiting and to which you provide data.
3. Legal bases for processing and use of data.
We may only use your personal data for purposes that are both legitimate and necessary (Art. 6 GDPR). In practice, this means that we process your personal data, whether or not in electronic form, for legitimate purposes in connection with our contractual relationship, our business and safety/security.
These purposes include, but are not limited to, the following:
- processing and fulfilling your requests and contracts;
- managing your account and the business relationship;
- sending you commercial, promotional or advertising information, or information about the use of our services;
- communications in connection with the performance of a contract;
- improving the design, layout and overall functionality of the Site;
- analysing data for statistical purposes.
4. Who can access personal data?
Personal data is only accessible to authorised staff, and only when strictly necessary.
In addition, depending on the processing concerned and solely in order to achieve the purposes set out in this Privacy Policy, the personal data collected by the means mentioned above may be communicated to and/or shared with:
- Oxyledger’s subcontractors (service providers) and partners. In this context, Oxyledger requires its service providers and partners to implement strict confidentiality and data protection measures.
Finally, Oxyledger may be required to disclose personal data at the request of judicial authorities or, more generally, where required by law or regulation.
5. Sources and origins of personal data.
In principle, the data we hold comes from you, when you fill in a form. If you do not wish to provide the mandatory or necessary information, you may lose the benefit of certain advantages and/or we may decide to end our services to you, or we will be unable to perform the contract.
6. Access to personal data – Who do we share your information with?
In accordance with the regulations in force, data may be transmitted on request to the competent authorities, in particular public bodies, solely to meet legal obligations, as well as to officers of the court, ministerial officers and debt collection bodies, and in the context of investigating offences committed on the internet.
Your data is essentially for internal use. We may share your data with third-party companies able to process it, for legitimate reasons and in particular for the proper performance of the contract, when we use service providers and subcontractors to deliver our services.
We only send them the data they need to perform their services.
We nevertheless ensure that our subcontractors comply with the GDPR.
The processing of data by these subcontractors is governed by a strict legal framework.
7. Data retention period.
We take the necessary measures to ensure that personal data is not kept for the purposes described above for longer than the legal periods.
8. What are your rights?
We undertake to take appropriate technical and organisational measures to ensure the security of the processing of everyone’s personal data (Art. 32 GDPR).
In accordance with the applicable data protection laws and regulations, you have a number of rights regarding your personal data, namely:
- Right of access (Art. 15 GDPR) and to information
You have the right to be informed in a concise, transparent, intelligible and easily accessible way about how your data is processed. You also have the right to obtain confirmation as to whether data concerning you is being processed and, where applicable, to access your own personal data and to obtain or make a copy of it within reason. - Right to rectification (Art. 16 GDPR)
You have the right to have inaccurate data about you corrected. You also have the right to have incomplete data completed. - Right to be forgotten (right to erasure – Art. 17 GDPR) and right to restriction of processing (Art. 18 GDPR)
We undertake to erase your personal data in particular in the following cases:- the data is no longer necessary for the purposes for which it was collected or processed;
- you object to the processing;
- the personal data has been processed unlawfully.
- Right to data portability (Art. 20 GDPR)
You have the right to receive your data in a structured, commonly used and machine-readable format, for your personal use or to transmit it to a third party of your choice. - Right to withdraw consent at any time (Art. 7 GDPR)
You may withdraw your consent to the processing of your data where the processing is based on your consent. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. - Right to lodge a complaint (Art. 77 GDPR)
You have the right to lodge a complaint at any time with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL – www.cnil.fr), if you consider that the processing of your personal data infringes the GDPR.
To exercise your rights, you can contact us by email: privacy@oxyledger.com
9. Our commitment.
Our objective is to implement security techniques to protect stored data against unauthorised access, misuse, alteration, unlawful or accidental destruction and accidental loss.
10. Data breach procedure.
It is always possible that personal data processed in connection with the contractual relationship may fall into the wrong hands as a result of human error, an IT error, etc.
Where a breach poses a high risk to the rights and freedoms of the individual, we will inform them immediately of the facts and of the measures taken. We will ensure that the breach is notified to the CNIL within 72 hours of becoming aware of it, unless the breach does not pose a high risk to the rights and freedoms of the individual (Art. 32–34 GDPR).
11. Consent.
Where processing is based on your consent – for example, sending you information about our services when you have ticked the box provided for this purpose – you may withdraw it at any time by simply writing to privacy@oxyledger.com. Withdrawing your consent does not affect the lawfulness of processing carried out beforehand.
The other processing operations described in this policy are based on other legal grounds provided for in Article 6 of the GDPR: pre-contractual measures taken at your request or performance of a contract, compliance with a legal obligation, or Oxyledger’s legitimate interest. They therefore do not require your consent.
12. Changes to our Privacy Policy.
We may occasionally amend this privacy policy, in particular to comply with regulatory, case-law, editorial or technical developments.
13. OxyDiagnostic quote requests.
Data controller: SAS OXYLEDGER, 85 rue Pierre Maximin Audemar, 29200 Brest, France.
Data collected via the form on the OxyDiagnostic page: first name, last name, job title, work email and phone number; establishment, type, SIRET and FINESS numbers (optional), address and billing address; intended purchasing method; project information (pharmacy software, export format, volume, timeframe, details); authorisation to analyse the export file. Where applicable: contact details of the lead pharmacist and of the purchasing or billing contact.
Purposes and legal bases:
- responding to your request, checking the feasibility of the audit and preparing a quote: pre-contractual measures taken at your request (Art. 6.1.b GDPR);
- sending you occasional information about our services, only if you have ticked the box provided: consent (Art. 6.1.a), which you may withdraw at any time;
- protecting the form against abuse and spam: legitimate interest (Art. 6.1.f).
Recipients: Oxyledger’s sales team. Requests are sent by email and are not stored on the website. Subcontractor: OVH (website and email hosting, France). The form does not use any third-party service such as a captcha or marketing tool.
Third-party contact details: if you provide the contact details of a lead pharmacist or purchasing contact, please inform them.
Retention period: three years from collection or from the prospect’s last contact. For customers, the duration of the contractual relationship, then the statutory periods, in particular for accounting purposes. Technical anti-abuse counters (encrypted IP address) are automatically deleted within 24 hours.
Catalogue files: after the order, the export file is sent through a separate secure channel, never through the form or by email. In accordance with the authorisation given in the request, it is analysed for the sole purpose of checking the quality and compliance of the data. It must not contain any data about patients, healthcare professionals or any other individual. Source files are deleted no later than 60 days after the debrief.
Your rights: access, rectification, erasure, restriction, objection and withdrawal of consent, which you can exercise by writing to privacy@oxyledger.com or at the address given in the “Contact” section. You may also lodge a complaint with the CNIL (www.cnil.fr).
14. Contact.
For any question about this Privacy Policy, or for any request concerning your data, you can contact us:
- by email: privacy@oxyledger.com;
- by post: 85 rue Pierre Maximin Audemar, 29200 Brest – FRANCE.